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What is claimed is: 

1. A method comprising: 

detecting a possible security problem at a client 

locations- 
transmitting notice of the possible security problem 

across a network in real time to a home location remotely 

located from the client location; 

determining at the home location an anomaly based on at 

least the possible security problem; and 

transmitting notice of the anomaly in real time to the 

client location. 

2. The method of claim 1 further comprising 
transmitting notice of the anomaly in real time to other 
client locations that may communicate with the home location 
over the network. 

3. The method of claim 1 further comprising notifying a 
firewall located between the client location and the home 
location about the anomaly. 

4. The method of claim 1 further comprising inspecting 
a packet that arrives at the client location to detect the 
possible security problem. 
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5. The method of claim 1 in which the network includes 
a virtual private network. 

6. The method of claim 1 in which the anomaly includes 
unauthorized access to the network. 

7. The method of claim 1 in which the anomaly includes 
unauthorized access of a resource accessible through the 
network. 

8. The method of claim 1 in which the anomaly includes 
unauthorized use of resources available through the network. 

9. An article comprising: 

a machine-readable medium which contains 
machine-executable instructions, the instructions causing a 
machine to: 

detect a possible security problem at a client 

location; 

transmit notice of the possible security problem 
across a network in real time to a home location remotely 
located from the client location; 

determine at the home location an anomaly based on 
at least the possible security problem; and 

transmit notice of the anomaly in real time to the 
client location. 
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10. The article of claim 9 further causing a machine to 
transmit notice of the anomaly in real time to other client 
locations that may communicate with the home location over the 
network 

11. The article of claim 9 further causing a machine to 
notify a firewall located between the client location and the 
home location about the anomaly. 

12. The article of claim 9 further causing a machine to 
inspect a packet that arrives at the client location to detect 
the possible security problem. 

13. The article of claim 9 in which the network includes 
a virtual private network. 

14. The article of claim 9 in which the anomaly includes 
unauthorized access to the network. 

15. The article of claim 9 in which the anomaly includes 
unauthorized access of a resource accessible through the 
network. 

16. The article of claim 9 in which the anomaly includes 
unauthorized use of resources available through the network. 

17. A method comprising: 

at a home location in a network, receiving from a remote 
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client location an indication of a possible security problem 
at the client; and 

determining in real time at the home location an 
existence of an anomaly based on at least the indication of 
the possible security problem. 

18. The method of claim 17 further comprising 
transmitting notice of the existence of the anomaly in real 
time from the home location to the remote client location. 

19. The method of claim 17 further comprising notice of 
the existence of the anomaly in real time from the home 
location to other remote client locations that many 
communicate with the home location over the network. 

20. The method of claim 17 further comprising notifying, 
from the home location, a firewall located between the remote 
client location and the home location about the anomaly. 

21. The method of claim 17 further comprising 
transmitting information from the home location to the remote 
client location to help the remote client location identify 
possible security problems. 

22. The method of claim 17 further comprising 

determining the existence of the anomaly based on at least 

information regarding previous anomalies. 
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23. A method comprising: 

detecting a possible security problem at a client 
location; 

transmitting notice of the possible security problem 
across a network in real time to a home location remotely 
located from the client location; and 

receiving in real time at the client location a notice 
from the home location indicating an existence of an anomaly 
based on at least the possible security problem. 

24. The method of claim 23 further comprising inspecting 
a packet that arrives at the client location to detect the 
possible security problem. 

25. The method of claim 23 further comprising receiving 
in real time at the client location a notice from the home 
location indicating an existence of a possible security 
problem detected by another client location that can 
communicate with the home location over the network. 

26. An apparatus comprising: 
a client terminal; 

a first mechanism accessible by the client terminal and 
configured to detect a possible security problem at the client 
terminal; 

a second mechanism accessible by the client terminal and 
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configured to transmit notice of the possible security problem 
across a network in real time to a server remotely located 
from the client terminal; and 

a third mechanism accessible by the client terminal and 
configured to receive updates from the server in real time 
regarding security problems that the first mechanism may use 
in detecting possible security problems. 

27. The apparatus of claim 26 in which the first 
mechanism is also configured to monitor packets that arrive at 
the client terminal for the possible security problem. 

28. An apparatus comprising: 
a server; 

a first mechanism accessible by the server and configured 
to determine an anomaly based on at least information from a 
client regarding a possible security problem; and 

a second mechanism accessible by the server and 
configured to transmit notice of the anomaly in real time over 
a network to the client and to other client locations that may 
communicate with the server over the network. 

29. The apparatus of claim 28 in which the first 
mechanism is also configured to determine the anomaly based on 
at least information regarding previously determined 
anomalies . 
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30. A system comprising: 
a client terminal; 

a server; 

a first client mechanism accessible by the client 
terminal and configured to detect a possible security problem 
at the client terminal; 

a second client mechanism accessible by the client 
terminal and configured to transmit notice of the possible 
security problem across a network in real time to a server 
remotely located from the client terminal; 

a third client mechanism accessible by the client 
terminal and configured to receive updates from the server in 
real time regarding security problems that the first client 
mechanism may use in detecting possible security problems; 

a first server mechanism accessible by the server and 
configured to determine an anomaly based on at least 
information from a client regarding a possible security 
problem; and 

a second server mechanism accessible by the server and 
configured to transmit notice of the anomaly in real time over 
the network to the client terminal. 

31. The system of claim 30 in which the first client 

mechanism is also configured to monitor packets that arrive at 

the client terminal for the possible security problem. 
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32. The system of claim 30 in which the first server 
mechanism is also configured to determine the anomaly based on 
at least information regarding previously determined 
anomalies . 

33. The system of claim 30 in which the second server 
mechanism is also configured to transmit notice of the anomaly 
in real time to other client locations that may communicate 
with the server over the network. 

34. The system of claim 30 further comprising a firewall 
located between the client terminal and the server and 
configured to act as an intermediary for information flowing 
between the client terminal and the server. 

35. The system of claim 34 in which the firewall 
includes a corporate server. 

36. A method comprising: 

processing information relating to possible security 
problems associated with a private network at a home location 
to determine a security problem; and 

modifying a monitoring agent included at each one of 
multiple clients to reflect the security problem, each one of 
the multiple clients capable of communicating the information 
to the home location. 
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37. The method of claim 36 further comprising performing 
the modifying in real time. 

38. The method of claim 36 in which the multiple clients 
can communicate the information in real time. 
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